chromium/third_party/blink/web_tests/accessibility/content-changed-notification-causes-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 
<html>
<head>
<script src="../resources/ahem.js"></script>
<script src="../resources/js-test.js"></script>
</head>
<body>

<div id="group" tabindex="0">

<ul role=textbox style='-webkit-transition: -webkit-transform linear 1117401740208157342s; content: counters(c, ".", disc); '>><keygen autofocus="">><body style='outline-style: ridge; font: normal normal 29266em/9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 Ahem, serif; '>
 
</div>

<p id="description"></p>
<div id="console"></div>
 
<script>
onload = function() {
    description("Ensures that this snippet does not lead to a crash. Bug 86029.");

    function walkAccessibilityTree(accessibilityObject) {
        var count = accessibilityObject.childrenCount;
        for (var i = 0; i < count; ++i)
            accessibilityObject.childAtIndex(i);
    }

    if (window.accessibilityController) {

        document.getElementById("group").focus();
        var focusedElement = accessibilityController.focusedElement;
        walkAccessibilityTree(focusedElement);

        document.getElementById('console').innerHTML += "PASS. WebKit did not crash.<br>";
    }
};
</script>

</body>
</html>